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(57) Abstract: A method for detecting malicious code in a stream of data traffic input to a gateway in a data network by monitoring 
^5 for suspicious data in the stream of data traffic. Upon detecting the suspicious data, an attempt is made to disassemble the suspicious 
^5 data and a threat weight is assigned for each instruction. The attempt to disassemble is initiated at initial instructions each with a 

different offset within the suspicious portion of data. The threat weights are accumulated respectively for each branch option in 
Q the disassembled code, producing respectively an accumulated threat weight for each branch option. When the accumulated threat 

weight exceeds a previously defined threshold level, an alert is generated and/or traffic is blocked from the source of the malicious 

code. 
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